XX (the data subject) – Complaint Upheld (Italy, 2023)

A former politician (the data subject) asked Google LLC (the controller) to remove a number of URLs associated with his name and which linked to articles containing information relating to his political commitment. As a matter of fact, he believed that considerable time passed and such disclosure of personal data was no longer in the public interest. On 5 May 2021, the data subject filed a complaint with the Italian DPA, requesting the controller to remove the content and alleging the damage suffered by his personal and professional reputation as a result of the long-standing online availability of such information. The data subject stressed that no legal action was undertaken against him because of the facts described in the publication and that his political career ended five years before the erasure request. The controller claimed that it failed to identify the name of the data subject on the page relating to one of the URLs concerned. As result, it only adopted manual measures to prevent the publication from appearing among the results associated with that name. Concerning the other URLs, the controller argued that it was not able to comply with the data subject's request, given that those were contents linked to the political role he played at the time of publication. More specifically, they related to a video where the data subject tried to persuade voters to vote for the party to which he belonged. The data subject made that video during his electoral campaign and deliberately published it for the purpose of public sharing. These circumstances, therefore, determined the existence of an interest of the public to have knowledge of it. Moreover, the controller argued that although the data subject did not currently hold political office, he nevertheless played a public role as a businessman. The DPA held that because the name of the data subject was not specified in the first URL link mentioned, there was no reason to take measures in this regard. However, with regard to the other URLs, the DPA considered that the contents concerned statements made by the data subject during political elections occurred almost ten years before. Moreover, the data subject did not hold political office for five years. Thus, the DPA held that there was no specific necessity to preserve the indexing of those contents on Google. Therefore, the Italian DPA ordered the controller to remove the URLs as search results that could be found in association with the name of the data subject and gave the controller twenty days to remedy to the situation, pursuant to Article 58(2)(c) and Article 58(2)(g) GDPR.